Oracle Errata System Oracle Linux 5.11 2026-06-23T10:14:00 Oracle Linux 9 [9.9p1-7.0.2] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] [9.9p1-7.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] [9.9p1-7 + 0.10.4-9] - Version bump [9.9p1-5 + 0.10.4-8] - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155825 - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page Resolves: RHEL-122302 [9.9p1-4] - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 [9.9p1-3] - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 [9.9p1-2] - Fix implicit destination path selection when source path ends with '..' Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 [9.9p1-1] - Rebase to version 9.9 Resolves: RHEL-108912 IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 CVE-2026-35414 cpe:/a:oracle:linux:9::appstream cpe:/o:oracle:linux:9:8:baseos_base cpe:/o:oracle:linux:9::baseos_latest